The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and come into force in three phases: the Data Protection Board immediately, the consent-manager framework on 13 November 2026, and the core obligations for every data fiduciary — including every hospital, diagnostic lab, other health facility and health-tech platform in India — on 13 May 2027. There is no small-entity exemption for healthcare, health data is sensitive personal data under the Act, and penalties reach ₹250 crore per violation.
This guide converts those dates into a working plan for a hospital that does not have a compliance department. If you want the background on the Act itself, start with our DPDP Act guide for hospitals; this post is about the timeline and the to-do list.
The three DPDP phases at a glance
| Phase | Date | What comes into force | What it means for a hospital |
|---|---|---|---|
| Phase 1 | 13 November 2025 | Rules 1–2 and 17–21: purpose, appointment and functioning of the Data Protection Board of India | The regulator exists. Complaints can be filed; nothing is yet enforceable against you. |
| Phase 2 | 13 November 2026 | Rule 4: registration, eligibility and obligations of Consent Managers; the Significant Data Fiduciary designation window opens | Government can start naming hospitals and health platforms as SDFs with heavier duties. Consent infrastructure becomes real. |
| Phase 3 | 13 May 2027 | Rules 3, 5–16, 22–23: consent notices, security safeguards, breach reporting, retention and erasure, grievance handling, children's data, data-principal rights | Full compliance is enforceable. Every obligation below applies to you from this date. |
Is a hospital a data fiduciary or a data processor?
A data fiduciary decides why and how personal data is processed. A data processor processes it on the fiduciary's behalf. Your hospital is the fiduciary for its patients' data. Your hospital management software vendor is a processor — unless it uses the data for its own purposes, in which case it becomes a fiduciary in its own right. The obligations, and the penalties, sit with the fiduciary. You cannot outsource them by buying software, but the right software makes most of them a configuration exercise rather than a project.
What the 13 May 2027 obligations actually require
1. Notice and consent at the point of collection
Before or at the time you collect personal data you must give a clear notice — what data, for what purpose, how to withdraw consent, how to complain — in plain language, and obtain consent that is free, specific, informed and unambiguous. For a hospital that means the registration desk. A tick-box buried in a paper form will not survive scrutiny; a short, itemised consent captured in the HMS against the patient record will.
2. Legitimate uses without consent
The Act allows processing without consent for certain legitimate uses, including medical emergencies and public-health measures. That covers the trauma patient in casualty; it does not cover marketing messages sent to that patient six months later.
3. Reasonable security safeguards
The Rules require, at minimum, encryption or masking, access control, logging and monitoring of access, backups for continuity, and contractual safeguards with processors. These are the technical controls: role-based access so a pharmacist cannot open clinical notes, named user logins so every action is attributable, audit logs that cannot be edited, encryption in transit and at rest, and tested off-site backups. Our guide to audit logs and role-based access covers what to look for.
4. Breach notification
Every personal-data breach must be reported to the Data Protection Board and to every affected data principal — the patient — without delay, with a fuller report to the Board within 72 hours. There is no materiality threshold: a lost laptop with the OPD register on it is a breach. You need a written incident plan and someone who owns it.
5. Retention and erasure
Data must be erased when its purpose is served or consent is withdrawn, subject to other laws. Medical-record retention rules under state Clinical Establishment Acts and NMC guidelines still apply, so the practical outcome is a written retention schedule per data class — clinical records kept for the statutory period, marketing consent and WhatsApp opt-ins erased on withdrawal.
6. Children's data
Processing a child's data requires verifiable parental consent. Paediatric and vaccination workflows should capture the guardian's consent explicitly rather than assuming it.
7. Data-principal rights and grievances
Patients gain enforceable rights to access a summary of their data, to correct and erase it, to nominate someone to exercise those rights, and to a grievance mechanism with a published response time. Hospitals need a named grievance contact and a workflow to answer requests.
What happens on 13 November 2026
Two things. First, Consent Managers — registered intermediaries through which a person can give, manage and withdraw consent across many fiduciaries — can begin registering with the Board. If that sounds familiar, it should: ABDM's consent-based record sharing is already built on exactly this model, which is one reason ABDM-integrated hospitals are ahead. Second, the Central Government can begin designating Significant Data Fiduciaries based on volume and sensitivity of data. SDFs must appoint a Data Protection Officer based in India, commission independent audits, and run data protection impact assessments. Hospital chains and large diagnostic networks should assume they are candidates.
A 12-month DPDP plan for a mid-size hospital
October to December 2026: know what you hold
- Map every place patient data lives — HMS, lab machines, PACS, Excel sheets, WhatsApp on staff phones, the old on-premise server nobody switched off.
- List every processor: HMS vendor, lab software, TPA portals, payment gateway, WhatsApp provider. Get a data-processing clause into each contract.
- Name a privacy owner — in a 50-bed hospital this is usually the administrator, not a new hire.
January to March 2027: fix collection and access
- Rewrite the registration consent into itemised purposes; capture it digitally in the HMS.
- Kill shared logins. Every user gets a named account with a role. Review permissions quarterly.
- Switch on audit logging for record views, edits, exports and deletions, and check that logs are tamper-evident.
- Write the retention schedule and configure it.
April to May 2027: prove you can respond
- Run a tabletop breach drill: lost phone, ransomware, a staff member exporting a patient list. Time the notification steps.
- Publish the grievance contact and the process for access, correction and erasure requests.
- Restore a backup end to end and record how long it took.
Ten questions to ask your HMS vendor before 13 May 2027
- Is patient data encrypted in transit and at rest, and where are the servers located?
- Can every user be given a named login with a role, and can we see who viewed a record?
- Are audit logs immutable, and can we export them for an investigation?
- Can consent be captured per purpose at registration and withdrawn later?
- How are WhatsApp messages to patients logged, and can a patient opt out?
- What is the backup schedule, where are backups stored, and when was a restore last tested?
- Will you sign a data-processing agreement with breach-notification timelines?
- Can we export our full data if we leave?
- Do you use our patients' data for any purpose of your own?
- How do you support ABDM consent-based sharing, which is the model DPDP consent managers follow?
Frequently Asked Questions
When is the DPDP compliance deadline for hospitals?
The core obligations for data fiduciaries take effect on 13 May 2027, eighteen months after the Rules were notified on 13 November 2025. The consent-manager phase begins on 13 November 2026. Hospitals should aim to be ready by November 2026 to leave time for staff training and drills.
Does the DPDP Act apply to small hospitals?
Yes. There is no small-entity exemption for healthcare. Any entity that processes the personal data of Indian residents is a data fiduciary, and health data is treated as sensitive — so a 10-bed hospital carries the same core obligations as a 500-bed one. The government may exempt some classes of fiduciary from specific provisions, but no such exemption for hospitals or other health facilities has been notified.
What is the penalty for a hospital data breach under DPDP?
The Act provides penalties of up to ₹250 crore per instance for failing to take reasonable security safeguards, and up to ₹200 crore for failing to notify a breach. The Board considers the nature, gravity and duration of the breach and the mitigation taken, so a documented programme materially reduces exposure.
Does HIPAA compliance make a hospital DPDP-compliant?
No. HIPAA is a United States law with no standing in India. Vendors advertising HIPAA compliance for Indian hospitals are describing a different regime. Ask about DPDP, the IT Act and ABDM instead. Our note on HIPAA for Indian hospitals explains the difference.
Make the deadline a configuration task, not a project
Healthixio ships with the controls the Rules ask for: named users with role-based access, tamper-evident login and activity logs, 256-bit encryption, ABDM consent-based record sharing, and encrypted nightly backups to two independent locations. See the security and admin control module, or talk to us about a DPDP readiness walkthrough for your hospital.